News for hackers. Stuff that matters.

A comment on Why does Google append while(1); in front of their JSON responses?. Parent comment

Re:Why does Google append while(1); in front of their JSON r... by thezilch on Monday February 04, 2013 @10:25PM (#5168837)
Not quite, thanks to Flash.

http://lists.webappsec.org/pipermail/websecurity_lists.webap...

Rails and Django patches/recommendations on the issue: http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypas... https://docs.djangoproject.com/en/1.2/releases/1.2.5/#csrf-e...

[ Parent | on HN ]
Re:Why does Google append while(1); in front of their JSON r... by deliminator on Tuesday February 05, 2013 @01:05AM (#5169421)
Correct me if I'm wrong, but does this not merely allow an attacker to cause the browser to make requests with custom headers? That is, it does not allow the attacker to gain the CSRF token, and if the CSRF token is not known to the attacker, he would still not be able to make API requests.
[ Parent | on HN ]